How we protect your data
UGLA's information security management system is certified to ISO/IEC 27001:2022. What that means in plain words: who has access, how data is encrypted and backed up, what happens in an incident.
Certified
ISO/IEC 27001:2022
Certification body: Swiss Approval
- № 372-02-270-00466 · MOI Tech LLC
- № 372-02-270-00467 · MOVI TECH LLC
Scope: software development, integration, implementation, customer support, sale and marketing
Certificates and registry check →In short
- Where UGLA runsIn the DigitalOcean cloud, in Frankfurt (Germany, EU): servers, databases and backups. We run no server rooms of our own.
- EncryptionIn transit (HTTPS/TLS, SSH) and at rest.
- AccessBy role, and only for those who need it for their work; sign-in with multi-factor authentication.
- BackupsInfrastructure and data are backed up; recovery plans set a target time for critical services and are tested.
- IncidentsEach is recorded and investigated; a breach involving personal data is reported to the supervisory authority within 72 hours where the GDPR requires it.
- AI assistantRuns on models inside our DigitalOcean infrastructure, with no third-party AI provider.
37 Annex A controls
Organisational controls
Who is responsible for security, how we assess risk, vet suppliers and act in an incident.
Policies and owners
The information security policy is approved by the CEO. Every document of the management system has an owner and is reviewed at least once a year, and after infrastructure changes, incidents or audits. The IMS committee and the IMS manager are responsible for the system, the data protection officer for personal data.
Risk assessment
Information security risks are assessed at least once a year and after significant changes. The Statement of Applicability covers all 93 Annex A controls: for each, whether it applies, why, and how far it is implemented. Top management approves the risk treatment plan and accepts the residual risks.
Segregation of duties
Conflicting duties are split between people, so that no one can change important data alone without a check. Access rights are reviewed regularly.
Suppliers
A supplier is vetted before we work with it, and its contract carries a security section, a non-disclosure agreement and further agreements where needed. Security requirements flow down to the supplier's own subcontractors, and the supplier tells us about material changes.
Sub-processors →Incidents
An incident management procedure: classifying and recording the event, containing it, investigating, finding the root cause and taking corrective action. Incident records are kept for at least 3 years, and the IMS manager reviews all incidents every quarter. A personal data breach is reported to the supervisory authority within 72 hours where the GDPR requires it, and to customers as their contract sets out.
Business continuity
The business continuity plan and the disaster recovery plan set the roles, the steps and the target recovery time for critical services. Recovery procedures are tested regularly. The plans also cover climate-related risks, as Amendment 1:2024 to ISO/IEC 27001 requires.
Independent review
An internal audit programme runs every year, with auditors independent of the area they review. Externally, Swiss Approval audits the system: the certification audit and annual surveillance audits.
Laws and standards
The GDPR, the Law of Ukraine "On Personal Data Protection", the Law of Ukraine "On the Basic Principles of Cybersecurity of Ukraine", the NIS2 Directive, ISO/IEC 27001:2022 and ISO 9001:2015.
8 Annex A controls
People
Security starts with the people who have access: screening, commitments, training.
Screening
We check a candidate's background within the law and assess their competence. Contractor companies are checked against the state register, their tax history and references.
Confidentiality
Every employee and contractor signs a non-disclosure agreement. The duty of confidentiality continues after the engagement ends.
Training
Information security training at onboarding, with a final test and a sign-off on the policies, then ongoing awareness of new threats.
Remote work
Work services are reached only through an encrypted VPN, with multi-factor authentication wherever the service supports it. Screen lock, a clear desk and clear screen rule, and no removable media.
Reporting events
Every employee knows where to report a security event or weakness, and the incident procedure makes sure it is acted on quickly.
14 Annex A controls
Physical controls
We work remotely and keep no data in offices: data centres protect it physically.
No server rooms of our own
We keep no servers or data on premises. Most of Annex A's physical controls therefore do not apply to us, and the Statement of Applicability says why.
Data centres
UGLA's data is kept in DigitalOcean's data centres in Frankfurt (Germany, EU), which provide the infrastructure's physical security, backup power and environmental protection.
Devices
Work devices are password-protected, sessions end after work, and sensitive information is not kept on laptops or removable media. A device is wiped before reuse or disposal, and access from a personal device is closed by deactivating the account.
34 Annex A controls
Technological controls
Access, encryption, backups, logs, vulnerabilities, and how we write and release code.
Access and sign-in
Access is denied unless explicitly granted: by role, on a need-to-know and least-privilege basis. Single corporate sign-in, multi-factor authentication, a log of successful and failed sign-ins. Access rights are reviewed at least once a year, privileged rights at least every six months and whenever a role changes.
Administrative access
Time-bound and on request, with mandatory multi-factor authentication and no shared accounts. Administrators' credentials are kept in a secrets vault and rotated.
Encryption
Data is encrypted in transit (HTTPS/TLS, SSH) and at rest. The cryptography policy sets how keys are issued, rotated and revoked.
Backups
Backups of the infrastructure and application data, of e-mail and documents, and of the source code. How long copies are kept is agreed with each asset's owner.
Logging and monitoring
Event logs of the infrastructure, web servers, databases, code repositories and corporate accounts are reviewed at least monthly and immediately after an alert. They are kept for 12 months in active storage and a further 24 months in the archive. Monitoring alerts on deviations, and alert thresholds are reviewed at least every six months.
Vulnerabilities
Vulnerability scanning, configuration reviews and, depending on risk, penetration tests of external and customer-facing services. Critical and high vulnerabilities get an owner and a deadline. Patches come only from official sources and are tested before deployment.
Report a vulnerability →Secure development
Development to OWASP ASVS, with Level 1 as the baseline for web applications. Changes go through code review and are tested by people other than their authors: access rights, configuration, data integrity, recovery after failure, static and dynamic analysis. New open-source libraries are checked for their licences. We do not outsource development.
Separate environments
Development, testing and production are separate. Testing uses artificial data, not copies of customers' data. A change reaches production only after approval and testing in the test environment, and each one is recorded in the change log.
Network
Environments are logically segregated, administration goes through a VPN, and network services are protected by access control, multi-factor authentication and monitoring.
Malware and leakage
E-mail is filtered for spam, phishing and malicious content, devices are protected, possible leakage channels are monitored, and data can be exported only with its owner's approval. Where personal data needs protecting, we use masking, pseudonymisation or anonymisation.
Deletion
When the retention period ends, data is deleted securely, together with outdated copies and temporary files.
AI assistant
UGLA's assistant runs on models hosted on DigitalOcean, within our own infrastructure. Data from UGLA is not sent to third-party AI providers.
Reviewing us as a supplier?
Management system documents we do not publish, such as the Statement of Applicability, are available on request under a non-disclosure agreement. Send your request, or your company's security questionnaire, to the data protection officer.
dpo@ugla.ua